Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I created /opt/chroot, create bin lib and other directories in it, copied libraries, bash and perl binaries in proper places. Also I placed my script into /opt/chroot/bin/.

Now I can run the script such a way:

# chroot /opt/chroot script.pl

There are two things that I am concerned about:

  1. Script gains root rights.
  2. There is a perl interpreter inside the chrooted environment.

How can I avoid these security holes?

share|improve this question

2 Answers 2

up vote 2 down vote accepted

Chroot's on linux are not for security, if you have root, or mount abilites inside a chroot it's easy to break out.

You should obviously drop root using su or similar, as long as the script doesn't have permissions to modify the interpreter files there shouldn't be a problem.

To do this you need to add a larger hunk of code in a copy of su, and the core bits of PAM.

Something like jailkit might be an easier way to manage this:

http://olivier.sessink.nl/jailkit/index.html

share|improve this answer
    
Can you provide me more information about dropping root? I have problems with user management in the chrooted environment... –  lexsys Aug 3 '09 at 12:17

Why don't you chroot inside of your perl script? In that way you don't need all the extra stuff inside of your chroot jail.

Just add chroot() http://perldoc.perl.org/functions/chroot.html at someplace in your script, followed by chdir("/").

After that, drop your privileges and you are set.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.